OneTrust Unveils Platform and Product Innovations to Govern AI at Enterprise Scale
OneTrust has expanded its OneTrust AI governance platform with new controls designed to govern enterprise AI, data, privacy, consent and risk as organisations deploy more AI systems.
Announced at TrustWeek 2026, the changes include OneTrust CORIE™, an AI Control Plane, a Governance Command Center and a headless experience through an MCP Gateway. OneTrust said the platform aims to bring governance controls closer to AI systems and agents as they operate.
The announcement comes as organisations continue deploying AI despite growing governance concerns. According to OneTrust’s 2026 AI-Ready Governance Report, 86% of surveyed organisations experienced an AI-related incident in the past year, yet only 27% slowed or paused deployment in response.
That gap creates a practical challenge for governance teams. They must manage risks that already exist while preparing for AI systems to make more decisions and take more actions across enterprise environments.
“As organisations put AI to work, their governance teams already have the context and expertise to guide them. The challenge now is applying that judgment to thousands of agent decisions a day,” said DV Lamba, Chief Product & Technology Officer at OneTrust.
“We are building the OneTrust Platform so governance moves with the work, from assessment to production. At TrustWeek, we showed how: enabling developers to embed governance into agent behavior via our headless experience through the MCP Gateway, while integrating CORIE into everyday business applications to make governance conversational and native. This enables teams to understand risk in context, act at the point of decision, and generate evidence as work happens – giving businesses the control to move AI into production and a foundation to scale.”
OneTrust described the latest release as an evolution of its platform for governance at AI speed and enterprise scale while keeping people in control.
The platform combines CORIE, the AI Control Plane and the Governance Command Center. Together, OneTrust said these components provide shared intelligence, connected workflows and controls for organisations deploying AI at scale.
Businesses can also extend the platform with additional policies, controls, workflows and decision logic for specific industry requirements.
OneTrust AI Governance Platform Uses CORIE as a Shared Intelligence Layer
OneTrust CORIE, or Contextual Orchestration for Reasoning, Intelligence and Evidence, connects governance context and decisions across privacy, consent, technology risk, third-party management and AI risk.
According to OneTrust, CORIE uses an existing understanding of an organisation’s environment and rules to help automate risk decisions while maintaining business oversight. It also records the information behind decisions and applied policies.
Trust Graph
Trust Graph maps AI systems and models alongside enterprise data, vendors and identities. It also connects those systems with consent signals and relevant governance requirements.
Reasoning Engine
The Reasoning Engine uses policies, previous assessments, and governance decisions to support consistent, context-aware decisions across connected governance programs.
Evidence Ledger
The Evidence Ledger records what information was considered, which policy or control applied, and what action followed. This creates an auditable record as work moves through the platform.
CORIE also provides shared context, reasoning, and evidence for agent interactions. This applies to OneTrust’s native agents, customer-built agents and third-party agents.
AI Control Plane Adds Runtime Governance
The AI Control Plane brings CORIE’s intelligence into AI workflows while those systems are operating.
OneTrust describes it as an independent control layer positioned between AI agents and enterprise systems. It evaluates actions as they occur and applies or orchestrates policies, guardrails and controls.
Depending on those controls, an AI action can proceed, be blocked, or require human approval.
The approach is intended to establish separation of duties for AI through system architecture rather than relying only on organisational boundaries.
Headless Experience Via MCP Gateway
OneTrust is extending its integrations beyond traditional APIs through a headless experience via MCP Gateway.
The capability enables AI-native integrations with applications such as ChatGPT, Claude, Copilot and Glean. OneTrust said this brings governance context, intelligence, and workflows into AI tools that employees and developers already use.
The company said the approach can reduce custom integration requirements and support use cases including assessments and agent development.
Private preview in Fall.
Governance Command Center Gives Teams Central Oversight
The Governance Command Center provides a central view of risk posture, governance activity, decisions, and exceptions.
Teams can manage policies and controls across privacy, consent, technology risk, third-party management and AI governance. They can also intervene when a decision requires human judgment.
*“Across the business, new uses of AI are improving how we operate and serve our customers. Our role in governance is to help bring those ideas into production with a clear understanding of the risks, confidence that our policies will hold, and evidence of what AI does. OneTrust’s vision connects those requirements to the way work actually happens, enabling teams like ours to govern AI at scale and support the pace of innovation that moves our business forward.” – Kelly Thewes, Global Head of Data Privacy Compliance & Chief Data Ethics & Privacy Officer at Fiserv *
Platform-Powered Experiences Target Governance Workflows
OneTrust is also extending CORIE across privacy, consent, technology risk, third-party management and AI programs.
The company said this shared context allows governance insights and decisions to move between programs. Its first applications focus on AI-driven assessments and posture management.
AI-Driven Assessments
AI-Driven Assessments combine conversational assessment agents, AI-generated answers with source lineage, Microsoft Teams engagement, and embedded support.
Context-aware chat can help respondents generate and refine answers. According to OneTrust, these capabilities can reduce assessment completion time by 66% on average.
Private preview in Fall.
Posture Management for Regulations
Posture Management for Regulations provides an evidence-backed view of compliance with regulations including GDPR and the EU AI Act.
The capability shows which requirements were evaluated and the evidence supporting each result. OneTrust said teams can use this information to identify compliance gaps, prioritise remediation and maintain an auditable view across governance programs.
Private preview in Fall.
Conversational Consent Brings Permission Into AI Interactions
As conversational AI changes how businesses interact with customers, OneTrust is developing a consent capability designed for those interactions.
Conversational Consent connects through the MCP Gateway. It combines customer-controlled messaging with explicit confirmation for one or multiple purposes.
The system preserves the relevant exchange between the agent and user on the consent receipt. OneTrust said this is designed to support AI-powered customer experiences while maintaining compliance and consumer choice.
Private preview in Fall.
AI-Driven RoPA Management Automates Privacy Documentation
AI-Driven RoPA Management targets Records of Processing Activities, or RoPAs.
The capability generates and updates RoPAs using source documents such as project briefs and contracts. Users can review proposed changes before the platform applies them.
OneTrust said this can reduce time spent on privacy documentation and allow teams to focus more attention on risk management.
Private preview in Winter.
Risk, Issue, and Control Recommendations
OneTrust is also introducing AI-based analysis of organisational policies against custom frameworks and control libraries.
The capability identifies gaps and risks before recommending controls designed to address them.
OneTrust said this gives risk and compliance teams greater visibility into enterprise risk posture and helps them prioritise actions.
Generally available in Winter.
Forward Deployed Engineering Program
OneTrust also introduced its Forward Deployed Engineering program.
The pilot embeds OneTrust engineers with select customer teams to build and test new solutions against real-world requirements.
Teams will work from a shared 12–18-month plan and build on CORIE alongside the customer’s existing technology stack.
The program gives OneTrust a way to develop and validate new governance capabilities directly within customer environments while using existing enterprise technology.
What Businesses Should Know
The TrustWeek 2026 announcements show OneTrust placing more emphasis on governance controls that operate alongside AI rather than relying solely on assessments before deployment.
The AI Control Plane is designed to evaluate agent actions at runtime. Meanwhile, CORIE provides shared context, reasoning, and evidence across governance programs. The MCP Gateway extends those controls into AI applications such as ChatGPT, Claude, Copilot, and Glean.
However, several announced capabilities remain in private preview. The Headless Experience Via MCP Gateway, AI-Driven Assessments, Posture Management for Regulations, and Conversational Consent are scheduled for private preview in Fall. AI-Driven RoPA Management is scheduled for private preview in Winter, while Risk, Issue, and Control Recommendations is expected to become generally available in Winter.
For organisations evaluating the OneTrust AI governance platform, the distinction between currently available capabilities and those still in preview will therefore matter when assessing deployment plans.
About OneTrust
OneTrust, the AI-Ready Governance Platform™, enables innovation through the responsible use of data and AI. Trusted by thousands of companies, including over half of the Fortune 500, we help businesses govern well and move fast, turning responsible data use into a catalyst for growth. To learn more, follow OneTrust on LinkedIn or visit www.onetrust.com.
© 2026 OneTrust LLC. All rights reserved. OneTrust and the OneTrust logo are trademarks or registered trademarks of OneTrust LLC in the United States and other jurisdictions. All other brand and product names are trademarks or registered trademarks of their respective holders.